A newly identified cybercrime operation, dubbed "StopAndProtect" by researchers at Check Point, has co-opted nearly 2,000 compromised WordPress websites, transforming them into a criminal network for malware distribution, data exfiltration, surveillance, and ransomware deployment. The campaign was first observed in May 2026.
The operation leverages these hacked WordPress sites as a multi-purpose infrastructure, using them to host various stages of malware, deliver command-and-control instructions, receive activity logs, and store stolen documents and screenshots. Check Point researchers discovered the extent of the operation when one of the command servers inadvertently exposed a directory listing via a PHP script, revealing numerous files, logs, and open folders.
The infection chain typically begins with a social engineering technique known as "ClickFix," which presents visitors with a fake CAPTCHA. Users are instructed to copy and execute a PowerShell command, which then initiates the download of further stages written in .NET. The malware toolkit is comprehensive, including components for file encryption, document theft, screen locking, and even a chat utility for direct communication with victims.
StopAndProtect does not always behave as traditional ransomware. In many instances, the operators first exfiltrate lists of files and then selectively steal specific documents. Encryption or screen locking may occur later, depending on the attackers' objectives and the data discovered. The malware also has capabilities to spread through SMB shares and USB devices, steal credentials, capture screenshots, and monitor WhatsApp activity, including searching for contact names and capturing associated phone numbers. This broad functionality suggests the operation extends beyond simple file encryption into a surveillance campaign with an integrated ransomware component.
The compromised WordPress sites often ran outdated versions of the platform or vulnerable plugins. One site examined by researchers was still using a 2021 version of WordPress, which had nearly 40 known vulnerabilities, including SQL injection, authentication bypasses, and arbitrary file upload flaws.
Researchers also found evidence suggesting that the malware operators may have accidentally infected themselves, leading to the upload of some of their desktop files to a collection server. This archive contained the source code for an automation tool designed to manage injected payloads at scale on compromised WordPress sites. The archive also included text files listing close to 2,000 compromised WordPress domains, providing an indication of the campaign's scale. The automation tool, written in Visual Basic 6, allowed the operators to upload and delete files, enable or disable fake CAPTCHA pages, change redirects, and manage additional payloads across the network of compromised sites.
Between mid-May and the end of July 2026, Check Point researchers identified over 700 archives containing stolen files, passwords, wallet information, screenshots, and activity logs. One exposed directory alone held more than 20,000 screenshot files, and researchers collected approximately 31,000 screenshots during their monitoring period. These captured images included victims' desktops, browser activity, antivirus windows, ransom messages, and lists of encrypted files.
By July 24, 2026, Check Point had associated more than 6,000 unique IP addresses with the campaign. The largest concentrations of these IP addresses were observed in the United States, Russia, and India, though IP location does not definitively identify the victims' true geographical location or the operators behind the attack.
